119 lines
5.2 KiB
YAML
119 lines
5.2 KiB
YAML
name: Testing build (all platforms)
|
|
|
|
# Unsigned testing builds for Linux + Windows + macOS in one matrix. Click
|
|
# "Run workflow" in the Actions tab, or push a 0.0.0-testing-* tag. All three jobs
|
|
# publish to a single 0.0.0-testing-<short-sha> prerelease (distinct asset names).
|
|
#
|
|
# Per OS:
|
|
# Linux -> .deb
|
|
# Windows -> NSIS installer (.exe)
|
|
# macOS -> .zip (arm64; dmg + signing are follow-ups)
|
|
#
|
|
# Unsigned: macOS is quarantined/Gatekeeper-blocked once downloaded
|
|
# (xattr -dr com.apple.quarantine "Agent Orchestrator.app"); Windows SmartScreen
|
|
# warns ("More info" -> "Run anyway"). Each OS builds on its own native runner so
|
|
# build-daemon.mjs compiles the bundled ao for that platform (host == target).
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- "0.0.0-testing-*"
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-latest
|
|
target: "@electron-forge/maker-deb"
|
|
- os: windows-latest
|
|
# Our custom NSIS maker's `name` (see makers/maker-nsis.ts); forge
|
|
# `--targets` matches the configured maker instance by this name.
|
|
target: "nsis"
|
|
- os: macos-latest
|
|
target: "@electron-forge/maker-zip"
|
|
runs-on: ${{ matrix.os }}
|
|
permissions:
|
|
contents: write
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
env:
|
|
# Pure-Go sqlite (modernc) needs no cgo; on Linux this also keeps the daemon
|
|
# static and portable across glibc.
|
|
CGO_ENABLED: 0
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: backend/go.mod
|
|
cache-dependency-path: backend/go.sum
|
|
- run: npm ci
|
|
- name: Build (unsigned)
|
|
# `npm run make` keeps the premake daemon build; --targets restricts to this
|
|
# platform's maker.
|
|
run: npm run make -- --targets ${{ matrix.target }}
|
|
# Smoke-install the NSIS installer on a clean, native x64 Windows runner.
|
|
# This is a build-vs-host verdict: if it installs here it proves the artifact
|
|
# is good and a failing user machine is host-side (AV/disk/signing); if it
|
|
# fails here the build/NSIS config is wrong. continue-on-error so a failed
|
|
# install never blocks publishing the artifacts. The runner has no real-time
|
|
# AV blocking, so a clean install here does NOT prove SmartScreen/Defender
|
|
# won't reject the unsigned binaries on end-user machines.
|
|
- name: Smoke-install the Windows installer
|
|
if: runner.os == 'Windows'
|
|
continue-on-error: true
|
|
timeout-minutes: 5
|
|
shell: pwsh
|
|
run: |
|
|
$setup = Get-ChildItem -Path out/make -Recurse -Filter '*.exe' |
|
|
Where-Object { $_.Name -like '*Setup*' } | Select-Object -First 1
|
|
if (-not $setup) { $setup = Get-ChildItem -Path out/make -Recurse -Filter '*.exe' | Select-Object -First 1 }
|
|
if (-not $setup) { Write-Host '::error::no NSIS installer (.exe) produced under out/make'; exit 1 }
|
|
Write-Host "Running $($setup.FullName) /S (silent)"
|
|
# electron-builder NSIS (assisted installer): /S installs silently.
|
|
$proc = Start-Process -FilePath $setup.FullName -ArgumentList '/S' -PassThru -Wait
|
|
Write-Host "Installer exit code: $($proc.ExitCode)"
|
|
# Per-user assisted install lands under %LOCALAPPDATA%\Programs; a
|
|
# per-machine install would land under Program Files.
|
|
$installDir = @(
|
|
(Join-Path $env:LOCALAPPDATA 'Programs\Agent Orchestrator'),
|
|
(Join-Path ${env:ProgramFiles} 'Agent Orchestrator')
|
|
) | Where-Object { Test-Path $_ } | Select-Object -First 1
|
|
if ($installDir) {
|
|
Write-Host "INSTALL OK: $installDir created"
|
|
Get-ChildItem $installDir | Select-Object Name | Format-Table -AutoSize
|
|
} else {
|
|
Write-Host "::warning::INSTALL: no known install dir found (checked LOCALAPPDATA\Programs and Program Files)"
|
|
}
|
|
- name: Publish to a 0.0.0-testing-<sha> prerelease
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
|
|
if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
|
|
TAG="${GITHUB_REF_NAME}"
|
|
else
|
|
TAG="0.0.0-testing-${GITHUB_SHA::7}"
|
|
fi
|
|
# Matrix jobs race here; first one creates the release, the rest hit
|
|
# "already exists" which is fine (|| true). Distinct asset names + --clobber
|
|
# make uploads idempotent across re-runs.
|
|
gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
|
|
--notes "Unsigned testing build (Linux .deb / Windows NSIS .exe / macOS .zip). Not signed; for testing only." \
|
|
|| true
|
|
# NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
|
|
find out/make -type f -print0 | while IFS= read -r -d '' f; do
|
|
echo "uploading: $f"
|
|
gh release upload "$TAG" "$f" --clobber
|
|
done
|